52

I have a small home automation lab (that I keep saying I'll expand, but haven't). In this setup, I have a control system to control lights (utilizing the x10 protocol), blinds, a Nest thermostat and two web cams.

With the recent record setting DDoS attacks utilizing unsecured IoT devices, I'd like to secure my small setup a bit.

What can a home user do to secure their network while still maintaining the "connect from anywhere" aspect that is a big part of the marketing?

24
+50

The absolute most common issue with IoT devices is default passwords. So change all the passwords. Pick a unique, random password for every device and write it down on paper (paper is safe from remote attackers and hard drive failures). 12 random (i.e. computer-generated) lowercase letters represent a good compromise between security and being hard to type. Each device should have a different password so that breaking one doesn't let the attacker break all of them. Enter the passwords in a password manager and use that password manager in the computers you use to control the devices.

If the device has different authorization channels, for example an administration password and a day-to-day usage password, use different passwords for both and only record the administration password on selected devices.

The second generic security measure is to ensure that all your devices are behind a firewall or at least a NAT device. A typical home router is sufficient, but you should turn off UPnP which can allow inadvertent back channels from the outside. The goal is to ensures that there's no direct way to connect from the Internet to the device. Connections should always go through a gateway that itself requires authentication to cross, and that you keep patched with any security updates.

You should also apply security updates on all the devices… if they exist at all, which can be a problem.

  • 1
    While not as secure, even setting all your own passwords to your first name is pretty secure and better than factory default (even if that is longer and complex). The reason being that most of the time IoT devices are not hacked but just logged into with default values. – Helmar Dec 8 '16 at 15:32
  • 1
    Necessary xkcd on passwords: imgs.xkcd.com/comics/password_strength.png – Tensibai Apr 21 '17 at 7:47
  • 1
    @Tensibai That's not really applicable here. That comic is about memorable passwords. You don't need a memorable password on an IoT device, the password would normally always be stored in your computer/phone's password manager. – Gilles 'SO- stop being evil' Apr 21 '17 at 8:29
  • 2
    @Tensibai 12 random lowercase letters is 56 bits of entropy. That's very slightly more than to a 5-word passphrase with the xkcd dictionary, and a lot easier to type for the occasional times when you do need to pass it. Random letters are bad for memorability, but for a password that you don't need to remember, that's the best choice. – Gilles 'SO- stop being evil' Apr 21 '17 at 8:47
21

As always, a big part of security with "connect from anywhere" setups is ensuring the security of your account information. The usual rules apply:

  • Don't share your password
  • Avoid using cookies to save passwords (although cookies are always hard to resist)
  • Regularly change passwords
  • Be aware of other breaches via email (phishing, scams, etc.) including breaches in credible company systems. For instance, if Target's customer database is breached, please change your passwords.
  • Use unique passwords (thanks @Gilles)
  • ... Many other internet security basics...

Here's a good list of things you can do to your network as explained in this TomsGuide article:

  • Don't use WEP!, instead use WPA2(PSK) or better on your network and keep up-to-date with which protocols are the strongest.
  • Keep your router/modem updated. I believe that most routers (especially older models) do not self-update and many people forget to check/install the latest firmware updates to their router.
  • Create a separate Wi-Fi network for your IoT devices. Alternatively, setup a subnet in your network to connect your IoT devices.
  • Install/setup a firewall on your router.
  • Disable any guest network or elevate the security protocol.

Unfortunately, security is mostly out of your control from a consumer level with apps, websites, and technically your raw data. All data transactions through virtually any type of network is susceptible to improper or unintended use.

The best you can do is protect your online usage and protect your local network from attacks.

  • 3
    Some good, some bad here, but more bad than good. “Avoid using cookies”: counterproductive. “Regularly change passwords”: pointless, usually counterproductive. Missing key point: don't use default passwords. – Gilles 'SO- stop being evil' Dec 7 '16 at 0:48
  • 2
    I have to agree with Gilles, most of those generic tips only apply half to IoT devices and even the routers connecting them. At best they apply to the web UI of any control dashboard or the like. – Helmar Dec 8 '16 at 15:31
13

Adding to the most basic IoT security rule Gilles details, the first rule of security at home is to secure your entry gate adequately. Proper settings on your router will stop most attacks in their tracks. If your router is not properly configured securing the devices behind it is moot. A compromised router means you have the possibility for man-in-the-middle attacks in your own home.

Thus, start with securing your router, then work your way to the IoT devices themselves.

10

Disable Universal Plug and Play

If you don't need it, it can also pose a security risk.

A virus, Trojan horse, worm, or other malicious program that manages to infect a computer on your local network can use UPnP, just like legitimate programs can. While a router normally blocks incoming connections, preventing some malicious access, UPnP could allow a malicious program to bypass the firewall entirely. For example, a Trojan horse could install a remote control program on your computer and open a hole for it in your router’s firewall, allowing 24/7 access to your computer from the Internet. If UPnP were disabled, the program couldn’t open the port – although it could bypass the firewall in other ways and phone home.

(From howtogeek.com: Is UPnP a Security Risk?)

8

For the "connect from anywhere" aspect, you are pretty much at the mercy of the software client you are provided to interact with the Nest etc. A secure client should use something like SSH, which not only encrypts the connection (to avoid eavesdropping), but also only allows a connection when the client knows the private key.

Some banking apps use a system where you have a gadget that gives you a number that's synchronised to the server in some way, so as well as using a password you have an ever-changing challenge number that is known only to the server and the holder of the gadget. I don't know of any these home systems that offer something similar, but this would make remote control much more secure.

Some systems allow you to lock down the range of IP addresses that a remote connection is allowed from. This is a bit rubbish, but I suppose better than nothing.

  • 1
    Well theoretically, if you never plan on going outside EU or america (or don't want to control domotica from there) you should just block connections. It helps against incidental scans etc, which I believe are most of the "hacks". But anyone who really wants to connect to your device, may set up a proxy or live near you. – Paul Jan 5 '17 at 15:55
8

A possible solution could be the usage of devices that are created specially to improve security. In case of an automated home, the first barrier is the router, and with a special one we can gain some benefits.

For example, the Norton Core Router1 offers the following features:

  1. It inspects all packets going through for known attacks.
  2. Frequent updates. So newly discovered security issues are handled rapidly.
  3. Multiple networking. You can have the most vulnerable devices in a separate network thus protecting the rest.
  4. Security score. Indentification of possible security issues and leaks and sums it up in one number.

These are just some highlights. For more details visit the links in this more detailed answer.

1 This idea was inspired by this question and this answer, so the credit should go to @Aurora0001 and @bang. Also, it is a good demonstration of the useful content we are building here.

7

Here are a few things that I quote from symantec.com:

  • Research the capabilities and security features of an IoT device before purchase
  • Perform an audit of IoT devices used on your network
  • Change the default credentials on devices. Use strong and unique passwords for device accounts and Wi-Fi networks
  • Use a strong encryption method when setting up Wi-Fi network access (WPA)
  • Disable features and services that are not required
  • Disable Telnet login and use SSH where possible
  • Disable Universal Plug and Play (UPnP) on routers unless absolutely necessary
  • Modify the default privacy and security settings of IoT devices according to your requirements and security policy
  • Disable or protect remote access to IoT devices when not needed
  • Use wired connections instead of wireless where possible
  • Regularly check the manufacturer’s website for firmware updates
  • Ensure that a hardware outage does not result in an unsecure state of the device

I strongly support especially the 3rd and 6th points - default passwords and Telnet logins are simply asking to be hacked.

5

There is another barrier you can raise that isn't even in your network. Unless you really need an externally addressable IPv4 address you can check if your Internet provider uses Dual Stack Lite. Often Internet providers switched to that standard to save IPv4 addresses, some however offer IPv4 options.

The thing with Dual-Stack Lite is that it offers you the advantages and disadvantages of a carrier-based NAT. While that does mean that you are unable to use services like DynDNS and cannot use IPv4 based open port to the outside it also means that you are completely unreachable for any IPv4 requests that come unexpectedly from the Internet. The carrier NAT will simply not forward those calls. Calls that don't reach you cannot compromise your setup.

Millions of end customers already enjoy that enhanced protection but if you have an activated IPv4 option you can consider deactivating it, if you don't actually need it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.